Modifying syslog messages from CSS

ziutek · ‎02-07-2008

Does anyone know if it is possible to moify the syslog messages generated by a CSS. Many of our machines send syslog to a single server. We would liek to filter these messages, and put them in different files according to type of device, ie. host names with se in them go to the switches folder, etc.

The problem is that the syslog messages generated by the CSS do not have anythign in them referring to the device itself, only a time stamp and the message. So it is impossible to foliter these messages.

Any idea?

Report Inappropriate Content · ‎02-13-2008

You definetely can send the log messages to any syslog server. You just need to know the IP address of the syslog server and the facility level for the syslog.

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11000series/v5.00/configuration/basic/guide/Logging

ziutek · ‎04-09-2008

Anyone have any ideas here?

This is a sample of the syslog messages coming from our css11000:

APR 9 14:28:16 1/1 503 NETMAN-6: CLM: Login jrothstein@128.127.96.1

APR 9 14:28:19 1/1 504 NETMAN-6: CLMcmd: sh circuits ,jrothstein@128.127.96.1

APR 9 14:28:27 1/1 505 NETMAN-6: CLMcmd: sh rule-summary,jrothstein@128.127.96.1

APR 9 14:28:30 1/1 506 NETMAN-6: CLMcmd: exit,jrothstein@128.127.96.1

APR 9 14:28:30 1/1 507 NETMAN-6: CLM: Logout jrothstein@128.127.96.1

We have seveal CSSes reporting to the same syslog server running sylog-ng and there is no way to filter them.

Any assistance would be greatly appreciated.

Joe